February 2016 - mingw - Fedora mailing-lists

[Bug 1281953] New: mingw-libxml2: libxml2: Buffer overread with HTML parser in push mode in xmlSAX2TextNode [epel-7]
by Red Hat Bugzilla 24 Feb '16

24 Feb '16

https://bugzilla.redhat.com/show_bug.cgi?id=1281953 Bug ID: 1281953 Summary: mingw-libxml2: libxml2: Buffer overread with HTML parser in push mode in xmlSAX2TextNode [epel-7] Product: Fedora EPEL Version: epel7 Component: mingw-libxml2 Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: rjones(a)redhat.com Reporter: amaris(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: erik-fedora(a)vanpienbroek.nl, fedora-mingw(a)lists.fedoraproject.org, ktietz(a)redhat.com, lfarkas(a)lfarkas.org, rjones(a)redhat.com, veillard(a)redhat.com Blocks: 1281950 This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of Fedora EPEL. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. epel-7 tracking bug for mingw-libxml2: see blocks bug list for full details of the security issue(s). This bug is never intended to be made public, please put any public notes in the blocked bugs. [bug automatically created by: add-tracking-bugs] Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1281950 [Bug 1281950] libxml2: Buffer overread with HTML parser in push mode in xmlSAX2TextNode -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=SkWvVUcN3b&a=cc_unsubscribe

1 6

[Bug 1277150] New: mingw-libxml2: libxml2: DoS when parsing specially crafted XML document if XZ support is enabled [epel-7]
by Red Hat Bugzilla 24 Feb '16

24 Feb '16

https://bugzilla.redhat.com/show_bug.cgi?id=1277150 Bug ID: 1277150 Summary: mingw-libxml2: libxml2: DoS when parsing specially crafted XML document if XZ support is enabled [epel-7] Product: Fedora EPEL Version: epel7 Component: mingw-libxml2 Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: rjones(a)redhat.com Reporter: amaris(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: erik-fedora(a)vanpienbroek.nl, fedora-mingw(a)lists.fedoraproject.org, ktietz(a)redhat.com, lfarkas(a)lfarkas.org, rjones(a)redhat.com, veillard(a)redhat.com Blocks: 1277146 This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of Fedora EPEL. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. epel-7 tracking bug for mingw-libxml2: see blocks bug list for full details of the security issue(s). This bug is never intended to be made public, please put any public notes in the blocked bugs. [bug automatically created by: add-tracking-bugs] Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1277146 [Bug 1277146] libxml2: DoS when parsing specially crafted XML document if XZ support is enabled -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=skNfyT0B5S&a=cc_unsubscribe

1 8

[Bug 1287614] CVE-2015-8383 pcre: Buffer overflow caused by repeated conditional group (8.38/3)
by Red Hat Bugzilla 24 Feb '16

24 Feb '16

https://bugzilla.redhat.com/show_bug.cgi?id=1287614 Bug 1287614 depends on bug 1287619, which changed state. Bug 1287619 Summary: CVE-2015-8383 mingw-pcre: pcre: Buffer overflow caused by repeated conditional group [epel-7] https://bugzilla.redhat.com/show_bug.cgi?id=1287619 What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1287636] CVE-2015-8386 pcre: Buffer overflow caused by lookbehind assertion (8.38/6)
by Red Hat Bugzilla 24 Feb '16

24 Feb '16

https://bugzilla.redhat.com/show_bug.cgi?id=1287636 Bug 1287636 depends on bug 1287642, which changed state. Bug 1287642 Summary: CVE-2015-8386 mingw-pcre: pcre: Buffer overflow caused by lookbehind assertion [epel-7] https://bugzilla.redhat.com/show_bug.cgi?id=1287642 What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1287636] CVE-2015-8386 pcre: Buffer overflow caused by lookbehind assertion (8.38/6)
by Red Hat Bugzilla 19 Feb '16

19 Feb '16

1 0

[Bug 1287614] CVE-2015-8383 pcre: Buffer overflow caused by repeated conditional group (8.38/3)
by Red Hat Bugzilla 19 Feb '16

19 Feb '16

https://bugzilla.redhat.com/show_bug.cgi?id=1287614 Tomas Hoger <thoger(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|CVE-2015-8383 pcre: Buffer |CVE-2015-8383 pcre: Buffer |overflow caused by repeated |overflow caused by repeated |conditional group |conditional group (8.38/3) -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1285399] CVE-2015-2328 pcre: infinite recursion compiling pattern with recursive reference in a group with indefinite repeat
by Red Hat Bugzilla 18 Feb '16

18 Feb '16

1 0

[Bug 1285399] CVE-2015-2328 pcre: infinite recursion compiling pattern with recursive reference in a group with indefinite repeat
by Red Hat Bugzilla 17 Feb '16

17 Feb '16

1 0

[Bug 1287614] CVE-2015-8383 pcre: Buffer overflow caused by repeated conditional group
by Red Hat Bugzilla 17 Feb '16

17 Feb '16

https://bugzilla.redhat.com/show_bug.cgi?id=1287614 Tomas Hoger <thoger(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fedora-mingw(a)lists.fedorapr | |oject.org, | |fidencio(a)redhat.com, | |klember(a)redhat.com, | |marcandre.lureau(a)redhat.com | |, rjones(a)redhat.com, | |t.sailer(a)alumni.ethz.ch -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1287636] CVE-2015-8386 pcre: Buffer overflow caused by lookbehind assertion
by Red Hat Bugzilla 17 Feb '16

17 Feb '16

1 0

[Bug 1281952] New: mingw-libxml2: libxml2: Buffer overread with HTML parser in push mode in xmlSAX2TextNode [fedora-all]
by Red Hat Bugzilla 16 Feb '16

16 Feb '16

https://bugzilla.redhat.com/show_bug.cgi?id=1281952 Bug ID: 1281952 Summary: mingw-libxml2: libxml2: Buffer overread with HTML parser in push mode in xmlSAX2TextNode [fedora-all] Product: Fedora Version: 23 Component: mingw-libxml2 Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: rjones(a)redhat.com Reporter: amaris(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: erik-fedora(a)vanpienbroek.nl, fedora-mingw(a)lists.fedoraproject.org, ktietz(a)redhat.com, lfarkas(a)lfarkas.org, rjones(a)redhat.com, veillard(a)redhat.com Blocks: 1281950 This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of Fedora. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. [bug automatically created by: add-tracking-bugs] Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1281950 [Bug 1281950] libxml2: Buffer overread with HTML parser in push mode in xmlSAX2TextNode -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=onjZDgIxYw&a=cc_unsubscribe

1 10

[Bug 1277149] New: mingw-libxml2: libxml2: DoS when parsing specially crafted XML document if XZ support is enabled [fedora-all]
by Red Hat Bugzilla 16 Feb '16

16 Feb '16

https://bugzilla.redhat.com/show_bug.cgi?id=1277149 Bug ID: 1277149 Summary: mingw-libxml2: libxml2: DoS when parsing specially crafted XML document if XZ support is enabled [fedora-all] Product: Fedora Version: 22 Component: mingw-libxml2 Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: rjones(a)redhat.com Reporter: amaris(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: erik-fedora(a)vanpienbroek.nl, fedora-mingw(a)lists.fedoraproject.org, ktietz(a)redhat.com, lfarkas(a)lfarkas.org, rjones(a)redhat.com, veillard(a)redhat.com Blocks: 1277146 This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of Fedora. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. [bug automatically created by: add-tracking-bugs] Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1277146 [Bug 1277146] libxml2: DoS when parsing specially crafted XML document if XZ support is enabled -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=6QqISaRX8I&a=cc_unsubscribe

1 12

[Bug 1276299] New: CVE-2015-7942 mingw-libxml2: libxml2: heap-based buffer overflow in xmlParseConditionalSections() [fedora-all]
by Red Hat Bugzilla 16 Feb '16

16 Feb '16

https://bugzilla.redhat.com/show_bug.cgi?id=1276299 Bug ID: 1276299 Summary: CVE-2015-7942 mingw-libxml2: libxml2: heap-based buffer overflow in xmlParseConditionalSections() [fedora-all] Product: Fedora Version: 22 Component: mingw-libxml2 Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: rjones(a)redhat.com Reporter: mprpic(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: drizt(a)land.ru, erik-fedora(a)vanpienbroek.nl, fedora-mingw(a)lists.fedoraproject.org, ktietz(a)redhat.com, lfarkas(a)lfarkas.org, rjones(a)redhat.com, veillard(a)redhat.com Blocks: 1276297 (CVE-2015-7942) This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of Fedora. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. [bug automatically created by: add-tracking-bugs] Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1276297 [Bug 1276297] CVE-2015-7942 libxml2: heap-based buffer overflow in xmlParseConditionalSections() -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=fZhozt3A5i&a=cc_unsubscribe

1 10

[Bug 1274225] New: mingw-libxml2: libxml2: Out-of-bounds memory access [fedora-all]
by Red Hat Bugzilla 16 Feb '16

16 Feb '16

https://bugzilla.redhat.com/show_bug.cgi?id=1274225 Bug ID: 1274225 Summary: mingw-libxml2: libxml2: Out-of-bounds memory access [fedora-all] Product: Fedora Version: 22 Component: mingw-libxml2 Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: rjones(a)redhat.com Reporter: amaris(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: drizt(a)land.ru, erik-fedora(a)vanpienbroek.nl, fedora-mingw(a)lists.fedoraproject.org, ktietz(a)redhat.com, lfarkas(a)lfarkas.org, rjones(a)redhat.com, veillard(a)redhat.com Blocks: 1274222 This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of Fedora. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. [bug automatically created by: add-tracking-bugs] Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1274222 [Bug 1274222] libxml2: Out-of-bounds memory access -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=wUyBa6ppBZ&a=cc_unsubscribe

1 12

[Bug 1262853] New: mingw-libxml2: libxml2: Out-of-bounds memory access when parsing unclosed HTMl comment [fedora-all]
by Red Hat Bugzilla 16 Feb '16

16 Feb '16

https://bugzilla.redhat.com/show_bug.cgi?id=1262853 Bug ID: 1262853 Summary: mingw-libxml2: libxml2: Out-of-bounds memory access when parsing unclosed HTMl comment [fedora-all] Product: Fedora Version: 22 Component: mingw-libxml2 Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: rjones(a)redhat.com Reporter: amaris(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: drizt(a)land.ru, erik-fedora(a)vanpienbroek.nl, fedora-mingw(a)lists.fedoraproject.org, ktietz(a)redhat.com, lfarkas(a)lfarkas.org, rjones(a)redhat.com, veillard(a)redhat.com Blocks: 1262849 This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of Fedora. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. [bug automatically created by: add-tracking-bugs] Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1262849 [Bug 1262849] libxml2: Out-of-bounds memory access when parsing unclosed HTMl comment -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=LE5Z3j5KiV&a=cc_unsubscribe

1 11

[Bug 1281756] New: CVE-2015-8126 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions
by Red Hat Bugzilla 16 Feb '16

16 Feb '16

https://bugzilla.redhat.com/show_bug.cgi?id=1281756 Bug ID: 1281756 Summary: CVE-2015-8126 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: amaris(a)redhat.com CC: drizt(a)land.ru, erik-fedora(a)vanpienbroek.nl, fedora-mingw(a)lists.fedoraproject.org, ktietz(a)redhat.com, lfarkas(a)lfarkas.org, paul(a)city-fan.org, phracek(a)redhat.com, rjones(a)redhat.com Buffer overflow vulnerabilities in functions png_get_PLTE/png_set_PLTE, allowing remote attackers to cause DoS to application or have unspecified other impact. These functions failed to check for an out-of-range palette when reading or writing PNG files with a bit_depth less than 8. Some applications might read the bit depth from the IHDR chunk and allocate memory for a 2^N entry palette, while libpng can return a palette with up to 256 entries even when the bit depth is less than 8. Affected versions of libpng are before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19. Upstream patches: https://github.com/glennrp/libpng/commit/81f44665cce4cb1373f049a76f3904e981… https://github.com/glennrp/libpng/commit/a901eb3ce6087e0afeef988247f1a1aa20… https://github.com/glennrp/libpng/commit/1bef8e97995c33123665582e57d3ed40b5… https://github.com/glennrp/libpng/commit/83f4c735c88e7f451541c1528d8043c31b… CVE assignment: http://seclists.org/oss-sec/2015/q4/264 -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=kwjqAGuHqm&a=cc_unsubscribe

1 68

[Bug 851819] New: Review Request: mingw-sparsehash - MinGW Extremely memory-efficient C++ hash_map implementation
by Red Hat Bugzilla 07 Feb '16

07 Feb '16

https://bugzilla.redhat.com/show_bug.cgi?id=851819 Bug ID: 851819 QA Contact: extras-qa(a)fedoraproject.org Severity: unspecified Version: rawhide Priority: unspecified CC: fedora-mingw(a)lists.fedoraproject.org, notting(a)redhat.com, package-review(a)lists.fedoraproject.org Assignee: nobody(a)fedoraproject.org Summary: Review Request: mingw-sparsehash - MinGW Extremely memory-efficient C++ hash_map implementation Regression: --- Story Points: --- Classification: Fedora OS: Unspecified Reporter: t.sailer(a)alumni.ethz.ch Type: Bug Documentation: --- Hardware: Unspecified Mount Type: --- Status: NEW Component: Package Review Product: Fedora Spec URL: http://sailer.fedorapeople.org/mingw-sparsehash.spec SRPM URL: http://sailer.fedorapeople.org/mingw-sparsehash-2.0.2-1.fc17.src.rpm Description: MinGW Extremely memory-efficient C++ hash_map implementation Approved MinGW packaging guidelines are here: http://fedoraproject.org/wiki/Packaging/MinGW -- You are receiving this mail because: You are on the CC list for the bug.

1 9

[Bug 1291312] New: CVE-2015-8540 libpng: underflow read in png_check_keyword()
by Red Hat Bugzilla 06 Feb '16

06 Feb '16

https://bugzilla.redhat.com/show_bug.cgi?id=1291312 Bug ID: 1291312 Summary: CVE-2015-8540 libpng: underflow read in png_check_keyword() Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: mprpic(a)redhat.com CC: drizt(a)land.ru, erik-fedora(a)vanpienbroek.nl, fedora-mingw(a)lists.fedoraproject.org, ktietz(a)redhat.com, lfarkas(a)lfarkas.org, paul(a)city-fan.org, phracek(a)redhat.com, rdieter(a)math.unl.edu, rjones(a)redhat.com An underflow read was found in png_check_keyword in pngwutil.c in libpng-1.2.54: If the data of "key" is only ' ' (0x20), it will read a byte before the buffer in line 1288. This issue impacts upstream versions 1.2.55, 1.0.65, 1.4.18, and 1.5.25 of libpng. An attacker could possibly use this flaw to cause an out-of-bounds read by tricking an unsuspecting user into processing a specially crafted PNG image. CVE assignment: http://seclists.org/oss-sec/2015/q4/469 Upstream issue: http://sourceforge.net/p/libpng/bugs/244/ Upstream patch: http://sourceforge.net/p/libpng/code/ci/d9006f683c641793252d92254a75ae9b815… -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=qQrX6Dct1p&a=cc_unsubscribe

2 29

[Bug 1291317] New: CVE-2015-8540 mingw-libpng: libpng: underflow read in png_check_keyword() [fedora-all]
by Red Hat Bugzilla 06 Feb '16

06 Feb '16

https://bugzilla.redhat.com/show_bug.cgi?id=1291317 Bug ID: 1291317 Summary: CVE-2015-8540 mingw-libpng: libpng: underflow read in png_check_keyword() [fedora-all] Product: Fedora Version: 23 Component: mingw-libpng Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: rjones(a)redhat.com Reporter: mprpic(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: drizt(a)land.ru, erik-fedora(a)vanpienbroek.nl, fedora-mingw(a)lists.fedoraproject.org, ktietz(a)redhat.com, lfarkas(a)lfarkas.org, rjones(a)redhat.com Blocks: 1291312 (CVE-2015-8540) This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of Fedora. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. [bug automatically created by: add-tracking-bugs] Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1291312 [Bug 1291312] CVE-2015-8540 libpng: underflow read in png_check_keyword() -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=9P0jjEHGyb&a=cc_unsubscribe

1 2

[Bug 1291319] New: CVE-2015-8540 mingw-libpng: libpng: underflow read in png_check_keyword() [epel-7]
by Red Hat Bugzilla 06 Feb '16

06 Feb '16

https://bugzilla.redhat.com/show_bug.cgi?id=1291319 Bug ID: 1291319 Summary: CVE-2015-8540 mingw-libpng: libpng: underflow read in png_check_keyword() [epel-7] Product: Fedora EPEL Version: epel7 Component: mingw-libpng Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: rjones(a)redhat.com Reporter: mprpic(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: drizt(a)land.ru, erik-fedora(a)vanpienbroek.nl, fedora-mingw(a)lists.fedoraproject.org, ktietz(a)redhat.com, lfarkas(a)lfarkas.org, rjones(a)redhat.com Blocks: 1291312 (CVE-2015-8540) This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of Fedora EPEL. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. epel-7 tracking bug for mingw-libpng: see blocks bug list for full details of the security issue(s). This bug is never intended to be made public, please put any public notes in the blocked bugs. [bug automatically created by: add-tracking-bugs] Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1291312 [Bug 1291312] CVE-2015-8540 libpng: underflow read in png_check_keyword() -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=9IMAx9fQVr&a=cc_unsubscribe

1 2

mingw-libgpg-error package
by Richard W.M. Jones 05 Feb '16

05 Feb '16

There was a build failure of mingw-libgpg-error during the mass rebuild: https://koji.fedoraproject.org/koji/taskinfo?taskID=12844070 I looked at this package, but it is quite old (1.12) relative to the current libgpg-error package (1.21). However updating to 1.21 is not straightforward, so I would appreciate some review of the attached patch from someone that knows what they're doing. It builds for me on Rawhide. I'm particularly suspicious of the renamed .dll file. Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones Read my programming and virtualization blog: http://rwmj.wordpress.com virt-builder quickly builds VMs from scratch http://libguestfs.org/virt-builder.1.html

2 1

[Bug 1304639] New: CVE-2015-8806 mingw-libxml2: libxml2: heap-buffer overread in dict.c [fedora-all]
by Red Hat Bugzilla 04 Feb '16

04 Feb '16

https://bugzilla.redhat.com/show_bug.cgi?id=1304639 Bug ID: 1304639 Summary: CVE-2015-8806 mingw-libxml2: libxml2: heap-buffer overread in dict.c [fedora-all] Product: Fedora Version: 23 Component: mingw-libxml2 Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: rjones(a)redhat.com Reporter: anemec(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: erik-fedora(a)vanpienbroek.nl, fedora-mingw(a)lists.fedoraproject.org, ktietz(a)redhat.com, lfarkas(a)lfarkas.org, rjones(a)redhat.com, veillard(a)redhat.com Blocks: 1304636 (CVE-2015-8806) This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of Fedora. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. [bug automatically created by: add-tracking-bugs] Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1304636 [Bug 1304636] CVE-2015-8806 libxml2: heap-buffer overread in dict.c -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1304640] New: CVE-2015-8806 mingw-libxml2: libxml2: heap-buffer overread in dict.c [epel-7]
by Red Hat Bugzilla 04 Feb '16

04 Feb '16

https://bugzilla.redhat.com/show_bug.cgi?id=1304640 Bug ID: 1304640 Summary: CVE-2015-8806 mingw-libxml2: libxml2: heap-buffer overread in dict.c [epel-7] Product: Fedora EPEL Version: epel7 Component: mingw-libxml2 Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: rjones(a)redhat.com Reporter: anemec(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: erik-fedora(a)vanpienbroek.nl, fedora-mingw(a)lists.fedoraproject.org, ktietz(a)redhat.com, lfarkas(a)lfarkas.org, rjones(a)redhat.com, veillard(a)redhat.com Blocks: 1304636 (CVE-2015-8806) This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of Fedora EPEL. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. [bug automatically created by: add-tracking-bugs] Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1304636 [Bug 1304636] CVE-2015-8806 libxml2: heap-buffer overread in dict.c -- You are receiving this mail because: You are on the CC list for the bug.

1 2

Version Discrepancy Report
by Michael Cronenworth 02 Feb '16

02 Feb '16

------------------------------------------ MinGW/native package version discrepancies ------------------------------------------ Fedora N Matches Found: 51 Fedora Rawhide Matches Found: 76 +---------------------------------------------+ | f23 | rawhide | owner | +-----------------------------------+---------------+---------------+-------------+ | SDL2 | | 2.0.4 | | | mingw-SDL2 | | 2.0.3 | maci | +-----------------------------------+---------------+---------------+-------------+ | SDL2_image | | 2.0.1 | | | mingw-SDL2_image | | 2.0.0 | maci | +-----------------------------------+---------------+---------------+-------------+ | SDL2_mixer | 2.0.1 | 2.0.1 | | | mingw-SDL2_mixer | 2.0.0 | 2.0.0 | maci | +-----------------------------------+---------------+---------------+-------------+ | binutils | | 2.26 | | | mingw-binutils | | 2.25 | epienbro | +-----------------------------------+---------------+---------------+-------------+ | boost | | 1.60.0 | | | mingw-boost | | 1.59.0 | sailer | +-----------------------------------+---------------+---------------+-------------+ | colord | 1.2.12 | 1.3.1 | | | mingw-colord | 1.2.9 | 1.2.9 | rhughes | +-----------------------------------+---------------+---------------+-------------+ | colorhug-client | 0.2.7 | 0.2.8 | | | mingw-colorhug-client | 0.2.6 | 0.2.6 | rhughes | +-----------------------------------+---------------+---------------+-------------+ | curl | 7.43.0 | 7.47.0 | | | mingw-curl | 7.42.0 | 7.42.0 | epienbro | +-----------------------------------+---------------+---------------+-------------+ | cxxtest | 4.4 | 4.4 | | | mingw-cxxtest | 3.10.1 | 3.10.1 | astokes | +-----------------------------------+---------------+---------------+-------------+ | freeglut | 3.0.0 | 3.0.0 | | | mingw-freeglut | 2.8.1 | 2.8.1 | rjones | +-----------------------------------+---------------+---------------+-------------+ | freetype | 2.6.0 | 2.6.2 | | | mingw-freetype | 2.6 | 2.6 | rjones | +-----------------------------------+---------------+---------------+-------------+ | gcc | 5.3.1 | 6.0.0 | | | mingw-gcc | 5.2.0 | 5.3.0 | epienbro | +-----------------------------------+---------------+---------------+-------------+ | gdb | 7.10.1 | 7.10.50.20160131 | | | mingw-gdb | 7.8.1 | 7.8.1 | kalev | +-----------------------------------+---------------+---------------+-------------+ | gettext | 0.19.7 | 0.19.7 | | | mingw-gettext | 0.19.4 | 0.19.4 | rjones | +-----------------------------------+---------------+---------------+-------------+ | giflib | 4.1.6 | 4.1.6 | | | mingw-giflib | 5.0.5 | 5.0.5 | smani | +-----------------------------------+---------------+---------------+-------------+ | glib-networking | | 2.47.1 | | | mingw-glib-networking | | 2.46.1 | kalev | +-----------------------------------+---------------+---------------+-------------+ | glib2 | | 2.47.5 | | | mingw-glib2 | | 2.47.4 | epienbro | +-----------------------------------+---------------+---------------+-------------+ | glibmm24 | 2.46.2 | | | | mingw-glibmm24 | 2.46.3 | | sailer | +-----------------------------------+---------------+---------------+-------------+ | gnutls | 3.4.8 | 3.4.8 | | | mingw-gnutls | 3.4.7 | 3.4.7 | rjones | +-----------------------------------+---------------+---------------+-------------+ | gstreamer1 | 1.6.3 | 1.7.1 | | | mingw-gstreamer1 | 1.6.0 | 1.6.0 | pfor | +-----------------------------------+---------------+---------------+-------------+ | gstreamer1-plugins-bad-free | 1.6.3 | 1.7.1 | | | mingw-gstreamer1-plugins-bad-free | 1.6.0 | 1.6.0 | elmarco | +-----------------------------------+---------------+---------------+-------------+ | gstreamer1-plugins-base | 1.6.3 | 1.7.1 | | | mingw-gstreamer1-plugins-base | 1.6.0 | 1.6.0 | pfor | +-----------------------------------+---------------+---------------+-------------+ | gstreamer1-plugins-good | 1.6.3 | 1.7.1 | | | mingw-gstreamer1-plugins-good | 1.6.0 | 1.6.0 | elmarco | +-----------------------------------+---------------+---------------+-------------+ | gtk3 | 3.18.7 | 3.19.7 | | | mingw-gtk3 | 3.18.6 | 3.18.6 | kalev | +-----------------------------------+---------------+---------------+-------------+ | gtkhtml3 | 4.10.0 | 4.10.0 | | | mingw-gtkhtml3 | 4.6.6 | 4.6.6 | epienbro | +-----------------------------------+---------------+---------------+-------------+ | gtksourceview3 | 3.18.2 | 3.19.4 | | | mingw-gtksourceview3 | 3.18.1 | 3.18.1 | kalev | +-----------------------------------+---------------+---------------+-------------+ | harfbuzz | 1.0.6 | 1.1.3 | | | mingw-harfbuzz | 1.0.3 | 1.1.2 | epienbro | +-----------------------------------+---------------+---------------+-------------+ | hunspell | 1.3.3 | 1.3.3 | | | mingw-hunspell | 1.3.2 | 1.3.2 | epienbro | +-----------------------------------+---------------+---------------+-------------+ | icu | 54.1 | 56.1 | | | mingw-icu | 50.1.2 | 50.1.2 | pfor | +-----------------------------------+---------------+---------------+-------------+ | libcroco | | 0.6.11 | | | mingw-libcroco | | 0.6.9 | rhughes | +-----------------------------------+---------------+---------------+-------------+ | libffi | 3.1 | 3.1 | | | mingw-libffi | 3.0.13 | 3.0.13 | bonzini | +-----------------------------------+---------------+---------------+-------------+ | libgcrypt | 1.6.4 | 1.6.4 | | | mingw-libgcrypt | 1.6.3 | 1.6.3 | rjones | +-----------------------------------+---------------+---------------+-------------+ | libgovirt | 0.3.3 | 0.3.3 | | | mingw-libgovirt | 0.3.2 | 0.3.2 | elmarco | +-----------------------------------+---------------+---------------+-------------+ | libgpg-error | 1.21 | 1.21 | | | mingw-libgpg-error | 1.12 | 1.12 | rjones | +-----------------------------------+---------------+---------------+-------------+ | libgsf | 1.14.33 | 1.14.33 | | | mingw-libgsf | 1.14.34 | 1.14.34 | greghellings| +-----------------------------------+---------------+---------------+-------------+ | libgusb | 0.2.8 | 0.2.8 | | | mingw-libgusb | 0.2.4 | 0.2.4 | rhughes | +-----------------------------------+---------------+---------------+-------------+ | libidn | 1.32 | 1.32 | | | mingw-libidn | 1.28 | 1.28 | epienbro | +-----------------------------------+---------------+---------------+-------------+ | libjpeg-turbo | 1.4.1 | 1.4.2 | | | mingw-libjpeg-turbo | 1.3.1 | 1.3.1 | epienbro | +-----------------------------------+---------------+---------------+-------------+ | libosinfo | 0.2.12 | 0.3.0 | | | mingw-libosinfo | 0.2.8 | 0.2.8 | berrange | +-----------------------------------+---------------+---------------+-------------+ | librsvg2 | 2.40.13 | 2.40.13 | | | mingw-librsvg2 | 2.40.12 | 2.40.12 | rhughes | +-----------------------------------+---------------+---------------+-------------+ | libsigsegv | 2.10 | 2.10 | | | mingw-libsigsegv | 2.6 | 2.6 | bonzini | +-----------------------------------+---------------+---------------+-------------+ | libsoup | | 2.53.2 | | | mingw-libsoup | | 2.52.2 | epienbro | +-----------------------------------+---------------+---------------+-------------+ | libssh2 | 1.6.0 | 1.6.0 | | | mingw-libssh2 | 1.4.3 | 1.4.3 | epienbro | +-----------------------------------+---------------+---------------+-------------+ | libtasn1 | | 4.7 | | | mingw-libtasn1 | | 4.5 | kalev | +-----------------------------------+---------------+---------------+-------------+ | libtiff | 4.0.4 | 4.0.6 | | | mingw-libtiff | 4.0.3 | 4.0.3 | epienbro | +-----------------------------------+---------------+---------------+-------------+ | libusbx | 1.0.20 | 1.0.20 | | | mingw-libusbx | 1.0.19 | 1.0.19 | elmarco | +-----------------------------------+---------------+---------------+-------------+ | libvirt | 1.2.18.2 | | | | mingw-libvirt | 1.2.16 | | berrange | +-----------------------------------+---------------+---------------+-------------+ | libvirt-glib | 0.2.2 | | | | mingw-libvirt-glib | 0.2.0 | | berrange | +-----------------------------------+---------------+---------------+-------------+ | libxml2 | 2.9.3 | 2.9.3 | | | mingw-libxml2 | 2.9.2 | 2.9.2 | rjones | +-----------------------------------+---------------+---------------+-------------+ | libzip | 1.1 | | | | mingw-libzip | 1.0.1 | | smani | +-----------------------------------+---------------+---------------+-------------+ | llvm | 3.7.0 | 3.7.1 | | | mingw-llvm | 3.0 | 3.0 | brouhaha | +-----------------------------------+---------------+---------------+-------------+ | nspr | | 4.11.0 | | | mingw-nspr | | 4.10.10 | greghellings| +-----------------------------------+---------------+---------------+-------------+ | openjpeg | 1.5.1 | 1.5.1 | | | mingw-openjpeg | 1.5.2 | 1.5.2 | smani | +-----------------------------------+---------------+---------------+-------------+ | opus | 1.1.2 | | | | mingw-opus | 1.1.1 | | valtri | +-----------------------------------+---------------+---------------+-------------+ | p11-kit | 0.23.2 | 0.23.2 | | | mingw-p11-kit | 0.23.1 | 0.23.1 | mooninite | +-----------------------------------+---------------+---------------+-------------+ | pango | | 1.39.0 | | | mingw-pango | | 1.38.1 | rjones | +-----------------------------------+---------------+---------------+-------------+ | pcre | 8.38 | 8.38 | | | mingw-pcre | 8.36 | 8.36 | astokes | +-----------------------------------+---------------+---------------+-------------+ | pixman | 0.33.6 | 0.33.6 | | | mingw-pixman | 0.33.2 | 0.33.2 | rjones | +-----------------------------------+---------------+---------------+-------------+ | postgresql | | 9.5.0 | | | mingw-postgresql | | 9.4.5 | mooninite | +-----------------------------------+---------------+---------------+-------------+ | proj | | 4.9.2 | | | mingw-proj | | 4.9.1 | smani | +-----------------------------------+---------------+---------------+-------------+ | qt5-qt3d | | 5.6.0 | | | mingw-qt5-qt3d | | 5.5.0 | epienbro | +-----------------------------------+---------------+---------------+-------------+ | qt5-qtbase | | 5.6.0 | | | mingw-qt5-qtbase | | 5.5.1 | epienbro | +-----------------------------------+---------------+---------------+-------------+ | qt5-qtdeclarative | | 5.6.0 | | | mingw-qt5-qtdeclarative | | 5.5.1 | epienbro | +-----------------------------------+---------------+---------------+-------------+ | qt5-qtgraphicaleffects | | 5.6.0 | | | mingw-qt5-qtgraphicaleffects | | 5.5.1 | epienbro | +-----------------------------------+---------------+---------------+-------------+ | qt5-qtimageformats | | 5.6.0 | | | mingw-qt5-qtimageformats | | 5.5.1 | epienbro | +-----------------------------------+---------------+---------------+-------------+ | qt5-qtlocation | | 5.6.0 | | | mingw-qt5-qtlocation | | 5.5.1 | epienbro | +-----------------------------------+---------------+---------------+-------------+ | qt5-qtmultimedia | | 5.6.0 | | | mingw-qt5-qtmultimedia | | 5.5.1 | epienbro | +-----------------------------------+---------------+---------------+-------------+ | qt5-qtquick1 | | 5.6.0 | | | mingw-qt5-qtquick1 | | 5.5.1 | epienbro | +-----------------------------------+---------------+---------------+-------------+ | qt5-qtscript | | 5.6.0 | | | mingw-qt5-qtscript | | 5.5.1 | epienbro | +-----------------------------------+---------------+---------------+-------------+ | qt5-qtsensors | | 5.6.0 | | | mingw-qt5-qtsensors | | 5.5.1 | epienbro | +-----------------------------------+---------------+---------------+-------------+ | qt5-qtsvg | | 5.6.0 | | | mingw-qt5-qtsvg | | 5.5.1 | epienbro | +-----------------------------------+---------------+---------------+-------------+ | qt5-qttools | | 5.6.0 | | | mingw-qt5-qttools | | 5.5.1 | epienbro | +-----------------------------------+---------------+---------------+-------------+ | qt5-qttranslations | | 5.6.0 | | | mingw-qt5-qttranslations | | 5.5.0 | epienbro | +-----------------------------------+---------------+---------------+-------------+ | qt5-qtwebkit | | 5.6.0 | | | mingw-qt5-qtwebkit | | 5.5.1 | epienbro | +-----------------------------------+---------------+---------------+-------------+ | qt5-qtwebsockets | | 5.6.0 | | | mingw-qt5-qtwebsockets | | 5.5.1 | epienbro | +-----------------------------------+---------------+---------------+-------------+ | qt5-qtxmlpatterns | | 5.6.0 | | | mingw-qt5-qtxmlpatterns | | 5.5.1 | epienbro | +-----------------------------------+---------------+---------------+-------------+ | readline | 6.3 | 6.3 | | | mingw-readline | 6.2 | 6.2 | rjones | +-----------------------------------+---------------+---------------+-------------+ | rest | 0.7.93 | 0.7.93 | | | mingw-rest | 0.7.92 | 0.7.92 | elmarco | +-----------------------------------+---------------+---------------+-------------+ | shapelib | 1.3.0f | 1.3.0f | | | mingw-shapelib | 1.3.0 | 1.3.0 | smani | +-----------------------------------+---------------+---------------+-------------+ | sqlite | 3.10.2 | 3.10.2 | | | mingw-sqlite | 3.8.4.3 | 3.10.2.0 | rjones | +-----------------------------------+---------------+---------------+-------------+ | taglib | | 1.11 | | | mingw-taglib | | 1.10 | amigadave | +-----------------------------------+---------------+---------------+-------------+

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

mingw February 2016